Additional to the already provided answer I'll point few things out and a TO-DO list

Start by getting him off your network.

1. Turn off your Wi-Fi.
2. Change your router admin password.
3. Change the security to WPA2. *
4. Disable WPS. **
5. Change to a long password easy to remember. ***
6. Use whitelist instead of blacklist. ****

*If your modem is old, then it might not have WPA2 personal, try WPA instead. (History note: WPA2 needed a hardware change from the old WEP standard, while WPA just needed a firmware update)

**If your router is old WPS have many vulnerabilities, and there's no need to have it available, just connect your devices the normal way.

***You got 63 ASCII, use 3 or 4 four words, add spaces (generally spaces aren't common in charsets), special symbols are hard for humans to remember but easy for computers to "guess", so use only one.

****Add your three devices - This will eventually render useless as previously stated that spoofing MAC is easy.

Whit all this, the bad guy would have more homework: With no WEP he can't capture/break WEP weak IV's, with no WPS he can't use wash/reaver to get the PIN or pixie dust attacks, etc. With WPA/2 he needs to capture a handshake (now WPA) from any of your devices, bruteforce it (hence the long password-This maybe will take months-years depending on the length), then eventually when trying to connect he will spoof any of your MAC address and then he's in. Hope this helps in any way.

Additional to the already provided answer I'll point few things out and a TO-DO list

Start by getting him off your network.

1. Turn off your Wi-Fi.
2. Change your router admin password.
3. Change the security to WPA2. *
4. Disable WPS. **
5. Change the SSID (Network name) ***
6. Change to a long password easy to remember. ****
7. Use whitelist instead of blacklist. *****

*If your modem is old, then it might not have WPA2 personal, try WPA instead. (History note: WPA2 needed a hardware change from the old WEP standard, while WPA just needed a firmware update)

**If your router is old WPS have many vulnerabilities, and there's no need to have it available, just connect your devices the normal way.

***Maybe he already have pre-generated keys for the SSID you're using, changing the name would render useless the space-time trade off he previously did.

****You got 63 ASCII, use 3 or 4 four words, add spaces (generally spaces aren't common in charsets), special symbols are hard for humans to remember but easy for computers to "guess", so use only one.

*****Add your three devices - This will eventually render useless as previously stated that spoofing MAC is easy.

Whit all this, the bad guy would have more homework: With no WEP he can't capture/break WEP weak IV's, with no WPS he can't use wash/reaver to get the PIN or pixie dust attacks, etc. With WPA/2 he needs to capture a handshake (now WPA) from any of your devices, bruteforce it (hence the long password-This maybe will take months-years depending on the length), then eventually when trying to connect he will spoof any of your MAC address and then he's in. Hope this helps in any way.